238 matches found
CVE-2026-40091
SpiceDB 1.49.0–1.51.0 logs startup configuration with the full datastore DSN (DatastoreConfig.URI), including plaintext password, when the log level is info. This exposes credentials in startup logs. The issue is fixed in 1.51.1. If upgrading is not possible, the recommended workaround is to set ...
CVE-2026-40091 SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside...
CVE-2026-40091 SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside...
CVE-2026-40091
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside...
CVE-2026-40091 SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside...
GHSA-JF4F-RR2C-9M58 SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
Impact When SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. Patches v1.51.1 Workarounds Change the log level to warn or error...
SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
Impact When SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. Patches v1.51.1 Workarounds Change the log level to warn or error...
EUVD-2026-22815
SpiceDB's SPICEDBDATASTORECONNURI is leaked on startup logs...
PT-2026-32969
Name of the Vulnerable Software and Affected Versions SpiceDB versions 1.49.0 through 1.51.0 Description When the system starts with the log level set to info, the startup 'configuration' log exposes the full datastore DSN, including the plaintext password, within the DatastoreConfig.URI variable...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: rancher-helm, kubeflow, rancher-telemetry, flux-source-controller, cerbos, neuvector-dbgen, grafana-mimir, kyverno-policy-reporter-kyverno-plugin, timestamp-authority, nri-apache, tofu-controller, metrics-agent, portieris, spark-operator, act, paranoia, dive,...
GHSA-HFVC-G4FC-PQHX vulnerabilities
Vulnerabilities for packages: kubernetes-csi-node-driver-registrar, ferretdb, k8sgpt, azurefile-csi, istio, containerd, flux-source-controller, kubernetes-csi-external-snapshotter, cluster-api-aws-controller, snyk-cli, kubescape-operator, cerbos, argo-cd, kube-logging-operator, grafana-mimir,...
CVE-2026-39883 vulnerabilities
Vulnerabilities for packages: dagdotdev, openfga, kyverno-notation-aws, crossplane-provider-aws-emrserverless, metallb-fips, op-geth, conftest, prometheus-podman-exporter, bank-vaults, crossplane-provider-aws-kafka-fips, docker-compose, tfsec, kubedock-fips, verticadb-operator,...
GHSA-HFVC-G4FC-PQHX vulnerabilities
Vulnerabilities for packages: dagdotdev, openfga, kyverno-notation-aws, crossplane-provider-aws-emrserverless, metallb-fips, op-geth, conftest, prometheus-podman-exporter, bank-vaults, crossplane-provider-aws-kafka-fips, docker-compose, tfsec, kubedock-fips, verticadb-operator,...
Improper Authorization
github.com/authzed/spicedb is vulnerable to Improper Authorization. The vulnerability is due to incorrect handling of permission unions referencing the same relation in the LookupResources API, which allows an attacker to bypass expected permission checks by causing incomplete or missing...
Information Disclosure
github.com/authzed/spicedb is vulnerable to Information Disclosure. The vulnerability is due to the exclusion operator in the authorization schema, where a large payload can cause the WriteRelationships call to fail silently, and incorrect permission check results are returned, allowing attackers...
GHSA-FW7P-63QQ-7HPR vulnerabilities
Vulnerabilities for packages: openfga, terragrunt, percona-xtradb-cluster-operator, temporal-server-fips, step-kms-plugin, spire-server-fips, certificate-transparency, kine, apko-fips, jitsucom-bulker, loki-fips, croc, dbmate, flux-kustomize-controller, keda-fips, sftpgo-plugin-eventstore,...
GHSA-FW7P-63QQ-7HPR vulnerabilities
Vulnerabilities for packages: chezmoi, kots, dgraph, croc, nuclei, nri-mysql, dbmate, cerbos, step, k3s, age, openbao, caddy, temporal-server, ratify, timestamp-authority, telegraf, sqlexporter, spire-server, sftpgo, amass, mattermost, juicefs, kine, step-kms-plugin, temporal, trufflehog, loki,...
GO-2026-4465 LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb
LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...